Ensure that all rules in RHEL ANSSI have references

Author: Mab879

controls/anssi.yml

@@ -1422,7 +1422,7 @@ controls:
           Another such service is winbind which is by default configured to connect securely to Samba domains.
           Other relevant services are NIS and Hesiod. These should not be used.
       status: pending
-      related_rules:
+      rules:
           - no_nis_in_nsswitch
 
     - id: R70
@@ -1453,6 +1453,7 @@ controls:
           - service_chronyd_or_ntpd_enabled
           - chronyd_specify_remote_server
           - chronyd_configure_pool_and_server
+          - service_chronyd_enabled
 
           # Derived from DAT-PA-012 R9
           # The default remote loghost is logcollector.
@@ -1566,6 +1567,8 @@ controls:
           - service_auditd_enabled
           - package_audit_installed
 
+          - audit_rules_mac_modification_etc_selinux
+
     - id: R74
       title: Configuring the local messaging service
       levels:

products/almalinux9/profiles/anssi_bp28_enhanced.profile

@@ -55,6 +55,10 @@ selections:
     - '!file_permissions_efi_user_cfg'
     - '!audit_rules_file_deletion_events_renameat2'
     - '!audit_rules_dac_modification_fchmodat2'
+    - '!audit_rules_mac_modification_etc_selinux'
+    - '!no_nis_in_nsswitch'
+    - '!service_chronyd_enabled'
+
     # disable R45: Enable AppArmor security profiles
     - '!apparmor_configured'
     - '!all_apparmor_profiles_enforced'

products/debian12/profiles/anssi_bp28_enhanced.profile

@@ -68,6 +68,10 @@ selections:
   - '!package_dracut-fips-aesni_installed'
   - '!audit_rules_file_deletion_events_renameat2'
   - '!audit_rules_dac_modification_fchmodat2'
+  - '!audit_rules_mac_modification_etc_selinux'
+  - '!no_nis_in_nsswitch'
+  - '!service_chronyd_enabled'
+
 
   # The following rule is not applicable to Debian 12
   - '!logind_session_timeout'

products/debian13/profiles/anssi_bp28_enhanced.profile

@@ -75,3 +75,6 @@ selections:
 
   # The following rule is not applicable to Debian 13
     - '!logind_session_timeout'
+    - '!audit_rules_mac_modification_etc_selinux'
+    - '!no_nis_in_nsswitch'
+    - '!service_chronyd_enabled'

products/ol10/profiles/anssi_bp28_enhanced.profile

@@ -32,6 +32,7 @@ selections:
     - '!sudo_add_umask'
     - '!cracklib_accounts_password_pam_minlen'
     - '!cracklib_accounts_password_pam_dcredit'
+    - '!no_nis_in_nsswitch'
     # authselect is enabled by default
     - '!enable_authselect'
     # this rule is not automated anymore

products/ol10/profiles/anssi_bp28_high.profile

@@ -36,6 +36,7 @@ selections:
     - '!sudo_add_umask'
     - '!cracklib_accounts_password_pam_minlen'
     - '!cracklib_accounts_password_pam_dcredit'
+    - '!no_nis_in_nsswitch'
     # authselect is enabled by default
     - '!enable_authselect'
     # this rule is not automated anymore

products/ol10/profiles/anssi_bp28_intermediary.profile

@@ -30,6 +30,7 @@ selections:
     - '!ensure_redhat_gpgkey_installed'
     - '!ensure_almalinux_gpgkey_installed'
     - '!sudo_add_umask'
+    - '!no_nis_in_nsswitch'
     # authselect is enabled by default
     - '!enable_authselect'
     # this rule is not automated anymore

products/ol10/profiles/anssi_bp28_minimal.profile

@@ -30,6 +30,7 @@ selections:
     - '!ensure_redhat_gpgkey_installed'
     - '!ensure_almalinux_gpgkey_installed'
     - '!security_patches_up_to_date'
+    - '!no_nis_in_nsswitch'
     # authselect is enabled by default
     - '!enable_authselect'
     # these packages do not exist in ol10 (R62)

products/ol7/profiles/anssi_nt28_enhanced.profile

@@ -50,3 +50,6 @@ selections:
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
     - '!audit_rules_dac_modification_fchmodat2'
+    - '!no_nis_in_nsswitch'
+    - '!audit_rules_mac_modification_etc_selinux'
+    - '!service_chronyd_enabled'

products/ol7/profiles/anssi_nt28_high.profile

@@ -76,3 +76,4 @@ selections:
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
     - '!audit_rules_dac_modification_fchmodat2'
+    - '!no_nis_in_nsswitch'